Debian Security Advisory

DSA-199-1 mhonarc -- cross site scripting

Date Reported:
19 Nov 2002
Affected Packages:
Security database references:
In the Bugtraq database (at SecurityFocus): BugTraq ID 6204.
In Mitre's CVE dictionary: CVE-2002-1307.
More information:

Steven Christey discovered a cross site scripting vulnerability in mhonarc, a mail to HTML converter. Carefully crafted message headers can introduce cross site scripting when mhonarc is configured to display all headers lines on the web. However, it is often useful to restrict the displayed header lines to To, From and Subject, in which case the vulnerability cannot be exploited.

This problem has been fixed in version 2.5.2-1.2 for the current stable distribution (woody), in version 2.4.4-1.2 for the old stable distribution (potato) and in version 2.5.13-1 for the unstable distribution (sid).

We recommend that you upgrade your mhonarc package.

Fixed in:

Debian GNU/Linux 2.2 (potato)

Architecture-independent component:

Debian GNU/Linux 3.0 (woody)

Architecture-independent component:

MD5 checksums of the listed files are available in the original advisory.